(ofbiz-framework) branch release24.09 updated: Fixed: [codeQL] Resolving specific Java issues (OFBIZ-12925)

[jleroux]

This is an automated email from the ASF dual-hosted git repository.

jleroux pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new c2d3b85105 Fixed: [codeQL]  Resolving specific Java issues 
(OFBIZ-12925)
c2d3b85105 is described below

commit c2d3b85105e60a0a61ac9a3039ca7b8456310c1b
Author: Jacques Le Roux <jacques.le.r...@les7arts.com>
AuthorDate: Mon Feb 24 08:31:53 2025 +0100

    Fixed: [codeQL]  Resolving specific Java issues (OFBIZ-12925)
    
    This concerns a possible server-side request forgery reported by CodeQL
    <<To fix the SSRF vulnerability, we need to ensure that the URL being used 
in
    the readXmlDocument method is validated and restricted to a set of allowed 
URLs
    or domains. This can be achieved by maintaining a whitelist of allowed URLs 
or
    domains and checking the user-provided URL against this list before 
proceeding
    with the request.>>
    
    Fortunately we already have and can use the host-headers-allowed property in
    security.properties. Here is the fix.
---
 .../base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git 
a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java 
b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java
index 0ac2e2ada8..b0e6d5c1d4 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java
@@ -87,6 +87,7 @@ public final class UtilXml {
     private static final String MODULE = UtilXml.class.getName();
     private static final XStream X_STREAM = createXStream();
     private UtilXml() { }
+    private final static List<String> hostHeadersAllowed = 
UtilMisc.getHostHeadersAllowed();
 
     private static XStream createXStream() {
         XStream xstream = new XStream();
@@ -395,9 +396,12 @@ public final class UtilXml {
 
     public static Document readXmlDocument(URL url, boolean validate, boolean 
withPosition)
             throws SAXException, ParserConfigurationException, 
java.io.IOException {
-        if (url == null) {
-            Debug.logWarning("[UtilXml.readXmlDocument] URL was null, doing 
nothing", MODULE);
-            return null;
+
+        if (!hostHeadersAllowed.contains(url.getHost())) {
+            Debug.logWarning("Domain " + url.getHost() + " not accepted to 
prevent host header injection."
+                    + " You need to set host-headers-allowed property in 
security.properties file.", MODULE);
+            throw new IOException("Domain " + url.getHost() + " not accepted 
to prevent host header injection."
+                    + " You need to set host-headers-allowed property in 
security.properties file.");
         }
         InputStream is = url.openStream();
         Document document = readXmlDocument(is, validate, url.toString(), 
withPosition);